Hey everyone, I was wondering if I can get some ideas on how to solve this dependency problem with Go modules. I am using Go 1.11.4 on Linux (Windows Subsystem for Linux to be exact).
The first part of the problem is that for one of my libraries, I am importing github.com/hashicorp/vault/api, which is an api client to access Vault servers. This package is pretty thin and does not contain a lot of dependencies. However, the root project at github.com/hashicorp/vault has quite a few dependencies. If I delete the current go.mod and go.sum files in my library and start from scratch: - I run go mod init github.com/username/mylibrary - I then run go mod tidy to add missing packages to my go.mod and generate a go.sum Go mod imports the Vault repository at its root (github.com/hashicorp/vault) as expected. Unfortunately, this pulls in a lot of subdependencies and I have a ton of indirect dependencies in my go.mod and go.sum. This is not unexpected of course as this is how go modules work. Unfortunately, this does slow down continuous integration builds and is probably not great for Github and VCS hosts as each build pulls in all of these unneeded dependencies. The second problem is that 2 of Vault's subdependencies (not sure how deep) is labix.org/v2/mgo and launchpad.net/gocheck. These are bazaar repos, so they necessitate the installation of the bzr tool. In my library, I added the following to my go.mod to force it to pull from the Github repos: replace labix.org/v2/mgo => github.com/go-mgo/mgo v0.0.0-20160801194620-b6121c6199b7 replace launchpad.net/gocheck => github.com/go-check/check v0.0.0-20180628173108-788fd7840127 This works great for running tests in the username/mylibrary repo as I no longer need to install bzr when running my CI builds. However, if I create another project such as github.com/username/some-project and import username/mylibrary, go mod will attempt to download launchpad.net/gocheck and labix.org/v2/mgo from the original bazaar repos when running go test and other commands.These causes errors such as `go: labix.org/v2/mgo@v0.0.0-20140701140051-000000000287: bzr branch --use-existing-dir https://launchpad.net/mgo/v2 . in /go/pkg/mod/cache/vcs/ca61c737a32b1e09a0919e15375f9c2b6aa09860cc097f1333b3c3d29e040ea8: exec: "bzr": executable file not found in $PATH `. This is quite annoying and I'd like to avoid having to add those `replace` statements in the go.mod of projects that consume the mylibrary package. In addition, consumers of my library would need to install bazaar (which most people probably won't have installed). The 2 options I have thought of are: 1. Ask the Vault team to extract the api package into a separate repository. I am not sure how likely they would be interested in doing this, but I am guessing it would be quite low. 2. Make a copy of the api package and copy it directly into my library. This is something I am hoping to avoid as much as possible, because I'd like to use go modules to manage my dependencies. Are there any other options I've missed? Cheers, Francis -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
